blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

CVEs stored22,604
Affected records46,307
Newest source updateNovember 9, 2026
CVE-2019-14679 August 8, 2019
core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF. Full details
MEDIUM 6.5
CVE-2019-14695 August 6, 2019
A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system… Full details
CRITICAL 9.8
CVE-2019-14348 August 5, 2019
The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter. Full details
CRITICAL 9.8
CVE-2019-13572 August 1, 2019
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection. Full details
CRITICAL 9.8
CVE-2019-14313 July 30, 2019
A SQL injection vulnerability exists in the 10Web Photo Gallery plugin before 1.5.31 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system… Full details
CRITICAL 9.8
CVE-2019-14327 July 30, 2019
A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the plugin settings. Full details
MEDIUM 6.5
CVE-2019-13635 July 30, 2019
The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversal. Full details
CRITICAL 9.1
CVE-2019-13571 July 29, 2019
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the… Full details
CRITICAL 9.8
CVE-2019-6726 July 29, 2019
The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_postratings_clear_fastest_cache and rm_folder_recursively in wpFastestCache.php mishandle ../ in an HTTP Referer header. Full details
MEDIUM 6.5
CVE-2019-14364 July 28, 2019
An XSS vulnerability in the "Email Subscribers & Newsletters" plugin 4.1.6 for WordPress allows an attacker to inject malicious JavaScript code through a publicly available subscription form using the esfpx_name wp-admin/admin-ajax.php POST parameter. Full details
MEDIUM 6.1
CVE-2019-14328 July 28, 2019
The Simple Membership plugin before 3.8.5 for WordPress has CSRF affecting the Bulk Operation section. Full details
HIGH 8.8
CVE-2019-1010209 July 23, 2019
GoUrl.io GoURL Wordpress Plugin 1.4.13 and earlier is affected by: CWE-434. The impact is: unauthenticated/unzuthorized Attacker can upload executable file in website. The component is: gourl.php#L5637. The fixed version is: 1.4.14. Full details
HIGH 7.5
CVE-2019-1010124 July 23, 2019
WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is:… Full details
MEDIUM 5.4
CVE-2019-14231 July 21, 2019
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization… Full details
CRITICAL 9.8
CVE-2019-14230 July 21, 2019
An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization… Full details
CRITICAL 9.8
CVE-2019-14206 July 21, 2019
An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php. Full details
HIGH 7.5
CVE-2019-14205 July 21, 2019
A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php. Full details
HIGH 7.5
CVE-2019-12934 July 20, 2019
An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter. Full details
HIGH 8.8
CVE-2019-13569 July 19, 2019
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the… Full details
CRITICAL 9.8
CVE-2019-1010104 July 18, 2019
TechyTalk Quick Chat WordPress Plugin All up to the latest is affected by: SQL Injection. The impact is: Access to the database. The component is: like_escape is used in Quick-chat.php line 399. The attack… Full details
CRITICAL 9.8
CVE-2019-13575 July 18, 2019
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via… Full details
CRITICAL 9.8
CVE-2016-10763 July 18, 2019
The CampTix Event Ticketing plugin before 1.5 for WordPress allows XSS in the admin section via a ticket title or body. Full details
MEDIUM 4.8
CVE-2016-10762 July 18, 2019
The CampTix Event Ticketing plugin before 1.5 for WordPress allows CSV injection when the export tool is used. Full details
HIGH 7.5
CVE-2019-13573 July 17, 2019
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the… Full details
CRITICAL 9.8
CVE-2019-13505 July 11, 2019
The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field, as demonstrated by email_1. Full details
MEDIUM 6.1
CVE-2019-13478 July 9, 2019
The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions. Full details
CRITICAL 9.8
CVE-2019-13414 July 8, 2019
The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php. Full details
MEDIUM 6.1
CVE-2019-13413 July 8, 2019
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php. Full details
CRITICAL 9.8
CVE-2019-13344 July 5, 2019
An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is… Full details
MEDIUM 5.3
CVE-2019-13275 July 4, 2019
An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use cache plugin" setting is enabled, is vulnerable to unauthenticated blind SQL… Full details
CRITICAL 9.8
CVE-2019-12570 July 3, 2019
A SQL injection vulnerability in the Xpert Solution "Server Status by Hostname/IP" plugin 4.6 for WordPress allows an authenticated user to execute arbitrary SQL commands via GET parameters. Full details
HIGH 8.8
CVE-2019-12826 July 1, 2019
A Cross-Site-Request-Forgery (CSRF) vulnerability in widget_logic.php in the 2by2host Widget Logic plugin before 5.10.2 for WordPress allows remote attackers to execute PHP code via snippets (that are attached to widgets and then eval'd to… Full details
HIGH 8.8
CVE-2019-12346 June 24, 2019
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post. Full details
MEDIUM 6.1
CVE-2019-10271 June 24, 2019
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once… Full details
MEDIUM 4.3
CVE-2019-10270 June 21, 2019
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible (due to lack of verification and correlation between the reset password key sent by mail and… Full details
HIGH 8.8
CVE-2018-16613 June 19, 2019
An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum is able to escalate privilege to the forum administrator without any form of user… Full details
CRITICAL 9.8
CVE-2013-7472 June 15, 2019
The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter. Full details
MEDIUM 6.1
CVE-2019-9881 June 10, 2019
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. Full details
MEDIUM 5.3
CVE-2019-9880 June 10, 2019
An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticated attacker, to retrieve all WordPress users details such as email address, role,… Full details
CRITICAL 9.1
CVE-2019-9879 June 10, 2019
The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registrations are allowed. This is related to the registerUser mutation. Full details
CRITICAL 9.8
CVE-2019-11185 June 3, 2019
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted… Full details
CRITICAL 9.8
CVE-2019-12566 June 3, 2019
The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack… Full details
MEDIUM 5.4
CVE-2019-11872 May 29, 2019
The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a pop-up window. Successful exploitation grants an attacker with a right to execute… Full details
HIGH 8.8
CVE-2019-10866 May 23, 2019
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter. Full details
CRITICAL 9.8
CVE-2017-6514 May 22, 2019
WordPress 4.7.2 mishandles listings of post authors, which allows remote attackers to obtain sensitive information (Path Disclosure) via a /wp-json/oembed/1.0/embed?url= request, related to the "author_name":" substring. Full details
MEDIUM 5.3
CVE-2019-12241 May 20, 2019
The Carts Guru plugin 1.4.5 for WordPress allows Insecure Deserialization via a cartsguru-source cookie to classes/wc-cartsguru-event-handler.php. Full details
CRITICAL 9.8
CVE-2019-12240 May 20, 2019
The Virim plugin 0.4 for WordPress allows Insecure Deserialization via s_values, t_values, or c_values in graph.php. Full details
CRITICAL 9.8
CVE-2019-12239 May 20, 2019
The WP Booking System plugin 1.5.1 for WordPress has no CSRF protection, which allows attackers to reach certain SQL injection issues that require administrative access. Full details
HIGH 7.2